FM Server 13 Apache defaults to "Indexes"

Issue report by John Duncan

Product

FileMaker Server

Version

13.0v1

Operating system version

Mac OS X 10.9.1

Description of the issue

When FileMaker Server 13 installs its own Apache web server it defaults the web server via the httpd.conf file to allow folder listing. This is a potential security issue and should not be the default state of the installation.

Steps to reproduce the problem

With FMS 13 installed put some files in a folder inside the htdocs folder and then go to the server via a web browser with that path and a list of files is displayed as long as there is no Index file.

Expected result

It should not allow it

Actual result

It shows a list of files and folders

Exact text of any error message(s) that appear

N/A

Workaround

Edit the httpd.conf file in <fmserver>/HTTPServer/conf/ and remove the "Indexes" from the line that reads

Options Indexes FollowSymLinks MultiViews